Apple Pay Express Transit flaw enables $10k theft

The stalemate between Apple and Visa over who owns this security flaw is a masterclass in corporate finger-pointing at the expense of user safety. Through man-in-the-middle relay attacks, attackers can trick iPhones into authorizing large payments by spoofing transit gate signals. While Mastercard and Amex have server-side checks to prevent this, only Visa remains vulnerable. Apple's May 11 security update failed to address the exploit, leaving users to manually disable Express Transit or switch card providers. Despite a live $10,000 demo by Veritasium, Visa continues to label the attack as impractical.